March 1 deadline approaching for HIPAA covered entities to submit breach reports

HIPAA covered entities (healthcare providers, health plans or healthcare clearinghouses) that discovered a breach of Protected Health Information (PHI) in 2014 involving fewer than 500 individuals are required to report those breaches by March 1, 2015.

The HITECH Breach Notification Rule requires covered entities to notify the affected individuals and the Secretary of the U.S. Department of Health and Human Services (HHS) (and in some cases, the media) of breaches of unsecured PHI, and requires business associates (generally, contractors or vendors who perform services or functions for covered entities and have access to PHI) to notify covered entities of breaches of unsecured PHI. In 2013, the Office for Civil Rights (OCR) of HHS revised the standard for determining whether a breach occurred. Any use or disclosure of unsecured PHI that is not permitted under the HIPAA Privacy Rule is now presumed to be a breach and, therefore, triggers the notification obligations, unless either the incident satisfies one of three relatively narrow exceptions, or the covered entity or business associate demonstrates a low probability that PHI has been compromised, based on a risk assessment of at least four factors as set forth in the Breach Notification Rule. The prior definition of “breach” (which was in effect prior to Sept. 23, 2013) focused on a “risk of harm” analysis.

Healthcare data breaches have afflicted a broad range of covered entities and business associates, including a virtual “who’s who” of healthcare providers, health plans and business associates, as well as many who are not used to being in the headlines, with the latest victim being Anthem. Since reporting began in 2009, 1,140 breaches involving 500 or more individuals have been reported to OCR and are listed on the OCR website.

Notification obligations

Covered entities must notify the affected individuals without unreasonable delay, and in no event more than 60 days after the covered entity discovers the breach or would have known of the breach if exercising reasonable diligence. The deadline for reporting breaches to OCR depends on whether the breach involves 500 or more individuals. Breaches involving fewer than 500 individuals must be reported to OCR no later than 60 days after the calendar year in which the covered entity discovers the breach. Breaches involving 500 or more individuals must be reported to OCR contemporaneously with the notice to the individuals.

Breaches discovered by a covered entity in calendar year 2014 and involving fewer than 500 individuals must be submitted via OCR’s website portal by March 1, 2015. The instructions and online Breach Portal are available on the U.S. Department of Health & Human Services website. A separate report must be submitted for each breach that occurred during the 2014 calendar year. A copy of the completed form should be printed prior to and after submission, and maintained in the covered entity’s records to document the notification.

Revised OCR Breach Portal

Those who have submitted breach notification in prior years may note that the Breach Portal has changed since last year. In particular, the Portal now includes a category for reporting by a covered entity on behalf of a business associate, even though the Breach Notification Rule requires the covered entity, and not the business associate, to report. This seems to reflect a stronger focus on identifying the business associate when a breach occurred at a business associate. The revised format also includes additional questions and option responses, as compared with the prior version of the portal.

Takeaway

Although the form is available online, it is critical that covered entities are counseled appropriately through the reporting process to ensure the notification is accurate and consistent with prior messaging regarding the breach. Before completing the online form, it is recommended that organizations consult with attorneys who have experience in data breach regulatory investigations to avoid any missteps that could come back to harm the organization during an OCR investigation.

 

 

For more information, please contact one of the attorneys listed below.